A sign detection of generation of system failure is performed by analyzing information relating to operation of a system. As causes of system failure, there are cases where there is a setting error of configuration information of the system, an operational situation of the system is changed, or the like. As a method of the sign detection of the system failure, there are methods of analyzing change of a set value of the configuration information and analyzing the operational situation according to change of logs such as events or messages that are output from the system.
As a method for detecting failure events, for example, there are methods for collecting system history information including system log information and/or failure information and system configuration information, and the log information and/or the failure information are converted into a unified data format in advance. In this method, there is stored symptom in which addition information including partial configuration information is added to a detection rule for detecting an event included in components associated with failure that has been generated. In addition, the degree of coincidence is calculated for each piece of the stored partial configuration information by comparing the obtained system configuration information and the partial configuration information added to the symptom and stored in the symptom, and an event in which the failure has generated is detected based on the calculated the degree of coincidence.
In addition, there is also a method of learning message patterns that have been observed and using the patterns in detection of the failure.
Japanese Laid-open Patent Publication No. 2010-108223, Japanese Laid-open Patent Publication No. 2010-231568, Japanese Laid-open Patent Publication No. 2011-170802, and International Publication Pamphlet No. WO 2012/029500 are examples of the related art.